PandaLabs has detected the appearance of the new C variant of the Netsky worm (W32/Netsky.C.worm). This malicious code is very similar to its predecessor, Netsky.B, which is still causing a large number of incidents worldwide. In fact, Netsky.B has been the virus most frequently detected by the free online antivirus Panda ActiveScan over the last few days.

Netsky.C reaches computers in an e-mail message whose subject, message body and attached file are selected at random from a long list of options.

When the attached file is run, Netsky.C copies itself to all the disk drives on the computer under the name WINLOGON.EXE.

It spreads by sending itself out to all the e-mail address it finds in files with the extensions .eml, .txt, .php, .pl, .htm, .html, .vbs, .rtf, .uin, .asp, .wab, .doc, .adb, .tbb, .dbx, .sht, .oft, .msg, .shtm, .cgi, and .dhtm stored on the computer. It does this using its own SMTP engine.

The worm also copies itself under a wide range of names to all the folders on the computer whose name contains the sequence of letters 'shar'. By doing this, it can also spread through P2P file sharing applications like KaZaA.

Netsky.C has been designed to emit a specific sequence of sounds through the speakers of the affected computer between 06:00 a.m. and 08:59 a.m. on February 26.

Finally, this worm inserts several entries in the Windows Registry in order to ensure that it is run whenever the infected computer is started up. Similarly, it deletes any entries that may have been created by other malicious code such as Mydoom.A and Mimail.T

Email Address

Spotlight

(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Learn about personal data bankruptcy and the cost of privacy, security and compliance, delivering digital security to a mobile world, and much more.

As ISPs, hosting providers and online enterprises around the world continue suffering the effects of DDoS attacks, often the discussions that follow are, “What is the best way to defend our networks and our customers against an attack?”

The code redirects visitors to another URL where the Fiesta exploit kit is hosted, which then tries to detect and exploit several vulnerabilities in various software. If it succeeds, the visitors are saddled with a banking Trojan.

Looking for an Android-based tablet for your child but don't know which one to choose? If you are concerned about the device's protection against random hackers, Bluebox Security has just released a review of the nine most popular Android tablet models aimed specifically at children.